4f0ab7848b2303328e2ada31d34d9dbdcd1afd130aac29c53c744d0f901c3954

Analysis

max time kernel
120s
max time network
143s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
22/05/2024, 16:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

67f391ab66c89c87fa32c213b4825b89_JaffaCakes118.html
Size

17KB
MD5

67f391ab66c89c87fa32c213b4825b89
SHA1

cf72c84bdef89a2326b8f856e4c68c220e7df9c9
SHA256

4f0ab7848b2303328e2ada31d34d9dbdcd1afd130aac29c53c744d0f901c3954
SHA512

0d5b25be7a59b49ec636e634aeac566088885160005a5988e802b2617f8b639d51386775e4d9ab3011b9d4d02331b5a7f53766f5200ae7014a912e22ad6e8c26
SSDEEP

384:mhDVQSE2Cta1y6knj5qXu6cGlNkrWo5xQo/iu/0nQStyQ9g+svcAmLO:mh24Cta1y625qXxcGlNkrWo5xQoqu1W+

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ab2640f41185644e8f5b1d250b593b1900000000020000000000106600000001000020000000e865d9c506c6d741c06587a41649aa4e9d42f80f0f7fa9d59a1e776a21bf1668000000000e800000000200002000000032d72a5f92f5e23e5d5a781e721443c86cc12add0921181fbfeb57182a706b6020000000b31df839d4b4e908347203f8539dd684ed07536c7094b08a856819e47b4342d6400000007864ddba55221ff204420c109d6dca6eaf3f72ed4339d7caebf7d5b9de78b1d9cb0847fd91e7e7fb2e4d9314141139aeb06643ef82eaa640891ca6eaa941dada	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ab2640f41185644e8f5b1d250b593b19000000000200000000001066000000010000200000004fbc9fe09d3134fd8cd209b637deaadf92ffccec7f40aa2ba840d8beddfb19e8000000000e80000000020000200000004c2772358115259c8fca339a5d0a2453a55adfa2f3f700de06a82165d24632889000000003db19b41df00b463039e83ae14c329e06db4a08e3ce5d35f47f0558f1c693e3ca2b730c4dd729f415bcdedeb438edde2d13ed81076c1071ec4ae8d1cbc8f268856e831e10c12651ac180f4bfdf6c114f08783cd41055b954edfa1b504e5471cf619b7d263b694613bb92c70bc0ce1c09919a72af455f6bf66c0ac7f6b2024ef9b14482de16f73848642e543d1a402f84000000020facd753745c60ed6d6053b524291c3bc679be1d3811b1ba40a2cc60733fb43a0f67a27b3fb77edd2c6ee1bfc5df1a31e8bb3a0143e68b0fcb8294210794947	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60e5b71f69acda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{42772891-185C-11EF-910D-CE7E212FECBD} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422558892"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2244	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2244	iexplore.exe
2244	iexplore.exe
2372	IEXPLORE.EXE
2372	IEXPLORE.EXE
2372	IEXPLORE.EXE
2372	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2244 wrote to memory of 2372	2244	iexplore.exe	28
PID 2244 wrote to memory of 2372	2244	iexplore.exe	28
PID 2244 wrote to memory of 2372	2244	iexplore.exe	28
PID 2244 wrote to memory of 2372	2244	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\67f391ab66c89c87fa32c213b4825b89_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2244
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2244 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2372

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
4f50716b68e32eadc4196283794fec82

SHA1
85e638b80130d17c4665111fcde88e187ec6afe0

SHA256
9907a65b483947293c7802206efd77c8d1568c5381df4559f7061ad66241e598

SHA512
cdfa121b6ce375ceb5c9fe851d8e9500c210816151711751ea77502481a51dc901916c718306bebd5906be34d96568e4b538e36157a11f558f4b8bb01a94966e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
42a1bdc4ddc2e313936745886d6911b8

SHA1
ed96e832ac6ef2d4fa5be46e43c023564fd20b3b

SHA256
ce1dd377fd98e36acb77faf907847cfd707a0bd00756810c4f6f25dc366b85ef

SHA512
11a73fdb33ab85ea3d44833763afa8180e0b1a40af2c0adb48d1b9edd9e0ceb3fdd6787b8649c23b664bf93a8a6d2291c04567bcca59b39e1e2e56d4996f3fe6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c40d07cc2da298a5040511bb000d1721

SHA1
bd6106a72e0da7bfd36acdf576b85410796daf3f

SHA256
e8106f4ed5a50b5038d5bbdb313772d17b264c1f866c8d6eac4e2f451d3fbb56

SHA512
8db07da17886c99db4d4d0eb91c4e5a856e653e3e5bb37894de388e043114af50bf665059865003b3913e28d5274e9b48e40b11e732cc61a216e36bc1c42a64e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ca0c029b3ae580c11920c3939150e68c

SHA1
ca51ef21665ade1271d3321bfa89eadb9884341c

SHA256
27d3c0219c7f4556f84d8820ef4a2954525683ba32932d545b0b21c4b6489534

SHA512
c434057e1c7e051955defd649f308a22c5ee85ef60c45b8ee24c1c8d1018b6029efe5bb6e18c2add62a4f9e7dd244ac5bc9e85745d9bde0285b5a9464c511462

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
23e3cff892009bd482abf6574aa94d8a

SHA1
6ee3030951f3ca6aaf6c54f3adf16300678656c5

SHA256
c9a39badb627574db2b87f48857f04978adb45430216a4cbe21f5059028e3a05

SHA512
dec22d087ae1a9e7e887191ca8499646732af5a2b1111642c1f72f3a9d760bf4e2ea7d29d5cd9d82658ce5b6197b3a05c88495c9d9d9140af407154ccab9eb09

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e39257e386c8c89c2441625483d34dc9

SHA1
36d4c9b034c988664fb89e65cbaa87994f1c9061

SHA256
d7efad2aafbc0558235edaec4cff05d1cd38021c4af281ff10ea08d284035b92

SHA512
764e0c745f2d21b8ddbf2d55d55c3d8b5cefb606509788e371602029eb1dbdfc1b270f67ec800009eea3356e324e5a87086e33d47b04b28f3e87d8fc1d5dce59

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8cad3ce51af9311c75bea6f96e495760

SHA1
53ec330828fa44a50ac3151e5000752fdc9ec0df

SHA256
8dc5b3be09abae14dba03ff3fafc264b2e77394e8e5c8dd75e6c919f4ae45b58

SHA512
a8556e5a5b299e9be941dfab291fa967f012f62b3ae6ae4b65f951bae051c854460b1fd47fe7ca94642a543020263f8de983e9fa9725bb40b57c3a7e35c9461d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dd2f109a5cbbf299f4b64ef062c02c94

SHA1
be039124688c7e760fac3900ea223c2110cb0a75

SHA256
d53cb58aa6294f8030c0ee6c02ab08ee442f2581dc53a9d44669d0f251c45571

SHA512
1dd3f799d3a95723a3be04eea45542196c25231b7475c0397f07b9d61b30671a52b530fe83e65888d1cbe9f76d075d08fa2582c00270a194ffde68fdc6b5366e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
326e5aa56977c93b991b497b5e9a3caf

SHA1
fc875b31568bed1acaa56ab7283a07fbbee68299

SHA256
20ac05c7c77587a51757af80921b69a18a8a89477a9dec5960db8f3246c51719

SHA512
a56f82228454c076b8b77534a0192e96b08f63f954ce26100abac3c433459141b9a0558e9d209746d746334d23b214445443e383a9465c20052d6c343a24899c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a4ee56b8ba6b9d9ff1bff841cd7d414d

SHA1
fcfa03a434a905a7ad7deec86bc89eb80942956d

SHA256
9cde072e669116916e95c8175470992c804be56a893c743df31d5113d6263c53

SHA512
13ef80c5baed70682520bf1a8886d3cff6951372a08413b735fa5f73203e00789ff376949995baa566b664857f262ad85e26b37d3ccdb41e42ebe824ed9dbcb9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ea57f4104e54b724ed31a3b6dbb89543

SHA1
835d65099dc470a13616da28e252978570f6a20c

SHA256
560e4aa4a05a227457d8f843e8c7d37c85e9562c12617204da4d89bc206de264

SHA512
e485b0c681e8870e801c12e4be4ba216ded662fae3097da68bdc6b496e408d08bc1eb127a77560ddbd8fac9f112de1287b83c37fc7dd2d2ffe2357fd21e61811

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
46aeaf735f36f1e1801aa049788b411f

SHA1
44c1c7f5be3ecf56709a693c16774c52510622fc

SHA256
ae70ba657a0d6fded996492f6fcbe3dba1000b672e8f839e2a2ede27c0278bd7

SHA512
02d34a1ab4403472dce5edc0be38edf9201e10552a46ecf7d67f936c0d125e6ea48d6f431aa5c5acc06be2477c436a1da6c079223f69bd7a22dde73bc83933ee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico

Filesize
4KB

MD5
da597791be3b6e732f0bc8b20e38ee62

SHA1
1125c45d285c360542027d7554a5c442288974de

SHA256
5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07

SHA512
d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar6C8F.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit